CVE-2026-16295 describes an improper access control vulnerability (CWE-284) in the Clearfy Cache WordPress plugin prior to version 2.4.3. The plugin fails to perform a capability check on one of its admin-page dispatch paths, enabling any authenticated user, such as a Subscriber, to render and access administrative settings pages. This exposure includes administrative nonces, which could potentially be leveraged in further attacks. The canonical page URL enforces proper access restrictions, but the flawed dispatch path bypasses these controls. No CVSS score or vendor advisory with patch information is currently available.

Any authenticated user, regardless of privilege level, can access administrative settings pages and view sensitive information such as administrative nonces. This could lead to unauthorized disclosure of sensitive configuration data and potentially facilitate further privilege escalation or administrative actions if combined with other vulnerabilities. However, there is no evidence of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict authenticated user roles to trusted users only and monitor for updates from the Clearfy Cache plugin maintainers. Avoid granting unnecessary authentication to low-privilege users who do not require access to administrative functions.